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Abstract 

The polynomial hierarchy plays a central role in classical complexity theory. Here, we define 
a quantum generalization of the polynomial hierarchy, and initiate its study. We show that not 
only are there natural complete problems for the second level of this quantum hierarchy, but that 
these problems are in fact hard to approximate. Using these techniques, we also obtain hardness of 
approximation for the class QCMA. Our approach is based on the use of dispersers, and is inspired 
by the classical results of Umans regarding hardness of approximation for the second level of the 
classical polynomial hierarchy [Umans, FOCS 1999]. The problems for which we prove hardness 
of approximation for include, among others, a quantum version of the Succinct Set Cover problem, 
and a variant of the local Hamiltonian problem with hybrid classical-quantum ground states. 

1 Introduction and Results 

Over the last decades, the Polynomial Hierarchy (PH) [MS72], a natural generalization of the class NP, 
has been the focus of much study in classical computational complexity. Of particular interest is the 
second level of PH, denoted E^. Here, we say a problem is in Yl^ if it has an efficient verifier with the 
property that for any YES instance x G {0, 1}" of the problem, there exists a polynomial length proof 
y such that for all polynomial length proofs z, the verifier accepts x, y and z. Note that the alternation 
from an existential quantifier over y to a for-all quantifier over z is crucial here - keeping only the 
existential quantifier reduces us to NP. 

It turns out that introducing such alternating quantifiers makes E^ a powerful class believed to be 
beyond NP. For example, there exist natural and important problems known to be in E^ but not in NP. 
Such problems range from "does the optimal assignment to a 3SAT instance satisfy exactly k clauses?" 
to practically relevant problems related to circuit minimization, such as "given a boolean formula C 
in Disjunctive Normal Form (DNF), what is the smallest DNF formula C equivalent to C?" (see, 
e.g. [Uma99 ]). The study of E^ has also led to a host of other fundamental theoretical results, such as 
the Karp-Lipton theorem, which states that NP <2 P/poly unless PH collapses to E^. E^ has even been 
used to prove that SAT cannot be solved simultaneously in linear time and logarithmic space HForOOl 
IFLvMV05l . For these reasons, Ej and more generally PH have occupied a central role in classical 
complexity theoretic research. 

Moving to the quantum setting, the study of quantum proof systems and a natural quantum general- 
ization of NP, the class Quantum Merlin Arthur (QMA) HKSV02H . has been a very active area of research 
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over the last decade. Roughly, a problem is in QMA if for any YES instance of the problem, there exists 
a polynomial size quantum proof convincing a quantum verifier of this fact with high probability. With 
the notion of quantum proofs in mind, we thus ask the natural question: Can a quantum generalization 
ofTi2 be defined, and what types of problems might it contain and characterize? Perhaps surprisingly, 
to date there are almost no known results in this direction. 

Our results: In this work, we introduce a quantum generalization of E^, which we call cq-E2, and 
initiate its study. Our results include cq-E2-completeness and cq-E2-hardness of approximation for a 
number of new problems we define. Our techniques also yield hardness of approximation for the com- 
plexity class known as QCMA. We now describe these results in further detail. 



Hardness of approximation for cq-1,2. To begin, we informally define cq-E2 (see Section [2] for 
formal definitions). 

Definition 1 (cq-E2 (informal)). A problem Yl is in cq-E2 if there exists an efficient quantum verifier 
satisfying the following property for any input x G {0, 1}": 



If x is a YES instance ofU, then there exists a classical proof y G {0, l} poly ^"' such that for all 
quantum proofs \z) G J B®P ol y( n ) ) the verifier accepts x, y and \z) with high probability. 

• If x is a NO instance ofYl, then for all classical proofs y G {0, l}P oly ( n ', there exists a quantum 
proof \z) G B® P ol y(") such that the verifier rejects x, y and \z) with high probability. 

We believe this is a natural quantum generalization of Ej. Here, the prefix cq in cq-E2 follows since 
the existential proof is classical, while the for-all proof is quantum. One can also consider variations 
of this scheme such as qq-E2, qc-E2, or CC-E2 (with a quantum verifier), defined analogously. In this 
paper, however, our focus is on cq-E2, as it is the natural setting for the computational problems for 
which we wish to prove hardness of approximation. Note also that unlike for Ej, the definition of cq-E2 
is bounded error - this is due to the use of a quantum verifier for cq-E2- This implies, for instance, that 
the quantum analogue of the classically non-trivial result BPP C Ej | |Sip83|lLau83L i.e. BQP C cq-E2, 



holds trivially. Finally, one can extend the definition of cq-E2 to an entire hierarchy of quantum classes 
analogous to PH by adding further levels of alternating quantifiers, attaining presumably different classes 
depending on whether the quantifier at any particular level runs over classical or quantum proofs. 

To next discuss hardness of approximation for cq-E2, we recall two classical problems crucial to our 
work here. First, in the NP-complete problem SET COVER, one is given a set of subsets {S,} whose 
union covers a ground set U, and we are asked for the smallest number of the S, whose union still covers 
U. If, however, the S, are represented succinctly as the on-se Qof a 3-DNF formula <p h we obtain a 
more difficult problem known as SUCCINCT SET COVER (SSC). SSC, along with a related problem 
IRREDUNDANT (IRR), are not just NP-hard, but are E^-complete (indeed, they are even E^-hard to 
approximate [Uma99]). SSC and IRR are defined as: 

Definition 2 (SUCCINCT SET COVER (SSC) HUma99ll ). Given a set S = {(pi} of 3-DNF formulae 
such that V/'gs & * J a tautology, what is the size of the smallest S' C S such that Vies' <Pi a tautology? 

Definition 3 (IRREDUNDANT (IRR) HUma99l ). Given a DNF formula <p = fx V f 2 V • • • V t n , what is 
the size of the smallest S Q {ij} =1 such that <p = V/es ^i >? 



By on-set, we mean the set of assignments which cause <pi to be true. 
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Our work introduces and studies quantum generalizations of SSC and IRR. In particular, analo- 
gous to the classically important task of circuit minimization, the quantum generalizations we define 
are arguably natural and related to what one might call "Hamiltonian minimization" - given a sum of 
Hermitian operators H = H,, what is the smallest subset of terms {H,} whose sum approximately 
preserves certain spectral properties of H? We hope that such questions may be useful to physicists in 
a lab who wish to simulate the simplest Hamiltonian possible while retaining the desired characteristics 
of a complex Hamiltonian involving many interactions. We remark that at a high level, the connection 
to cq-Z,2 f° r the task of Hamiltonian minimization is as follows: The classical existential proof encodes 
the subset of terms {H,}, while the quantum for-all proof encodes complex unit vectors which achieve 
certain energies against H. The problem QUANTUM SUCCINCT SET COVER is now defined as 
follows. 

Definition 4. QUANTUM SUCCINCT SET COVER (QSSC) (informal) Given a set of local Hamilto- 
nians {Hi} such that H, has smallest eigenvalue at least a, what is the size of the smallest subset S 
of the Hi such that J^h gS Hi ^ as smallest eigenvalue at least a? Any subset satisfying this property is 
called a cover. 

Here, a local Hamiltonian is a sum of Hermitian operators, each of which acts non-trivially on at 
most k £ ©(1) qubits (hence the name £>local Hamiltonian). Intuitively, the goal in QSSC is to cover 
the entire Hilbert space using as few interaction terms H, as possible. Hence, we associate the notion of 
a "cover" with obtaining large eigenvalues, as opposed to small ones, making QSSC a direct quantum 
analogue of SSC. We remark that since SSC is a classical constraint satisfaction problem, we believe the 
language of quantum constraint satisfaction, i.e. Hamiltonian constraints, is a natural avenue for defining 
QSSC. Our first result concerns QSSC, and is as follows. 

Theorem 5. QSSC is cq-Z,2" complete, and moreover is co^Li-hard to approximate within N 1 ~ £ for all 
e > 0, where N is the encoding size of the QSSC instance. 

By hard to approximate, we mean that any problem in cq-E2 can be reduced to an instance of QSSC via 
a polynomial time mapping or Karp reduction such that the gap between the sizes of the optimal cover 
in the YES and NO cases scales as N 1_e . In other words, it is cq-Z,2-hard to determine whether the 
smallest cover size of an arbitrary instance of QSSC is at most g or at least g' for g ! / g G Q(N 1 ~ e ) 
(where g' > g). We next define the problem QUANTUM IRREDUNDANT (QIRR). 

Definition 6. QUANTUM IRREDUNDANT (QIRR) (informal) Given a set of succinctly described 
orthogonal projection operators {Hi} acting on N qubits, and a set {c,- > 0} C IR, define H : = 
J^iCiHi. Then, what is the size of the smallest subset S C {H,} such that for H' = J^H eS c iH» 
vectors achieving high and low energies against H continue to obtain high and low energies against H', 
respectively? 

Here, by a succinctly described projector, we mean a possibly non-local operator which is the tensor 
product of /c-local projectors for some k S ©(1)- This non-local structure naturally generalizes IRR, 
where the DNF formula is allowed to be non-local. Our next result is the following. 

Theorem 7. QIRR is co^Li-hard to approximate within N?~ £ for all e > 0, where N is the encoding 
size of the QIRR instance. 

Hardness of approximation for QCMA. The techniques from above can be used in a straightfor- 
ward manner to show hardness of approximation for QCMA. Here, the class QCMA [AN02] is defined 
as cq-Z,2 with the second (quantum) proof omitted, and can hence be thought of as the first level of 
our "c^-hierarchy". By defining the problem QUANTUM MONOTONE MINIMUM SATISFYING 
ASSIGNMENT (QMSA) (see Section|5]), we show: 
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Theorem 8. QMSA is QCMA-complete, and moreover is QCMA-hard to approximate within N e for 
all e > 0, where N is the encoding size of the QMSA instance. 

A canonical cq-E2 -complete problem. Our last results concern a canonical Yl^ -complete problem, 
EjSAT, and its generalization to the quantum setting. Specifically, given a boolean formula (p, E/SAT 
asks whether: 

3xiVx23x3 • • • Vx,- such that (p(x\, X2, X3, . . . , X;) = 1. 

Here, we have assumed i is even; for odd i, the last quantifier is a 3. The terms Xj are vectors of boolean 
variables. For i = 2, one can define a natural quantum generalization of this problem, denoted cq-Z^LH 
and defined in Section|6| using local Hamiltonians whose ground states are tensor products of a classical 
string and a quantum state. We show: 

Theorem 9. cq-E2LH is cq-Y,2-complete. 

Moreover, by defining an appropriate variant of cq-E2LH, denoted cq-E2LH-HW and also defined in 
Section [6] where the goal is to minimize the Hamming weight of the classical portion of the ground 
states mentioned above, we obtain the following result. 

Theorem 10. cq-E2LH-HW is co^Lx-complete, and moreover is ca^^-hard to approximate within 
N 1_e for any e > 0,for N the encoding size of the cq-E2LH-HW instance. 

Proof ideas: Our proofs are inspired by the classical work of Umans ||Uma991 |Hem02|| , and are 
achieved in a few steps. First, we show a gap-introducing reduction from an arbitrary cq-E2 prob- 
lem to a problem we call QUANTUM MONOTONE MINIMUM WEIGHT WORD (QMW) using dis- 
perses (see e.g., IISZ941 [TSUZ07I0 . We then show the following gap-preserving reductions, where <k 
denotes a mapping or Karp reduction: 

QMW < K QSSC < K QIRR . (1) 

This yields hardness ratios of N e for some e > 0. To obtain the stronger results claimed in Section[T] we 
finally apply the gap amplification of Umans [Uma99 ] and improved disperser construction of Ta-Shma, 
Umans, and Zuckerman [TSUZ071. 

In the classical setting, Umans BUma991 IHem 021 used dispersers to attain hardness of approxima- 
tion results relative to E^ for the classical problems MMWW (the classical version of QMW), SSC and 
IRR. To extend his techniques to the quantum setting, the most involved aspects of our work are the gap- 
preserving reductions from QMW to QSSC to QIRR. Here, an intricate balancing act involving carefully 
defined local Hamiltonian terms is needed to construct operators with the spectral properties required 
for our reductions. To analyze the resulting sums of non-commuting Hamiltonians, we require heavier 
machinery, such as the specific structure of Kitaev's local Hamiltonian construction [KSV02], the Pro- 
jection Lemma of Kempe, Kitaev, and Regev [KKR06 ], and the Geometric Lemma of Kitaev [KS V0211 . 

Finally, to show cq-E2-completeness of cq-E2LH, we study the interplay between classical-quantum 
proofs and Kempe and Regev's [KR03 ] 3-local Hamiltonian construction. Specifically, a careful analysis 
reveals that any cq-E2 verification circuit can be modified in such a way that fixing the value c of its 
classical proof register leads to an effective Hamiltonian H c . We then study the spectrum of H c to 
achieve the desired result. Moving on to cq-E2LH-HW, hardness of approximation is now attained by 
combining our reduction for cq-E2LH with the result that QMW is hard to approximate. 
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Previous and related work: In terms of hardness of approximation, the related question of whether 
a quantum PCP theorem holds is currently one of the biggest open problems in quantum complexity 
theory (see, e.g., BAar06l [AALV091 lAra 1 01 IHas 121 ). Regarding quantum generalizations of PH, the only 
previous work we are aware of is that of Yamakami [Yam02]. However, the results of Yamakami are 
largely unrelated to ours (for example, complete problems are not studied), and the proposed definition 
of Reference [Yam02] differs from ours in a number of ways: It is based on quantum Turing machines 
(whereas we work with quantum circuits), allows quantum inputs (whereas here, like QMA, the input to 
a problem is a classical string), and considers quantum quantifiers at each level of the hierarchy (whereas 
in its full generality our scheme allows alternating between classical and quantum quantifiers between 
levels as desired). 

Significance and open questions: The classical polynomial hierarchy plays an important role in clas- 
sical complexity theory, both as a generalization of NP and as a proof tool in itself. It is hoped that 
the scheme we propose here for generalizing PH to the quantum setting will find similar applications 
in quantum complexity theory. Second, the problems we show to be cq-E2-complete here are arguably 
rather natural, and in embodying a generalization of classical circuit minimization or optimization, may 
hopefully be related to practical scenarios in a lab. Further, although the alternation between classical 
and quantum quantifiers in cq-E2 may a priori seem odd, the notion of relating a classical proof to, say, 
subsets of local Hamiltonian terms, and the quantum proof to quantum states achieving certain energies 
is in itself quite natural, and in our opinion justifies the study of such a combination of quantifiers. Third, 
with respect to hardness of approximation, since whether a quantum PCP theorem holds remains a chal- 
lenging open question, it is all the more interesting that one is able to prove hardness of approximation 
in a quantum setting here using an entirely different tool, namely that of dispersers. We remark that 
dispersers and their two-sided analogues, extractors, have been used classically to amplify existing PCP 
inapproximability results [SZ94, Zuc96|. However, as far as we are aware, neither are known to directly 
yield PCP constructions. 

We leave a number of questions open: What other natural problems are complete for cq-E2 or 
higher levels? Can we say anything non-trivial about the relationship between E 2 and cq-E2? How 
do the different classes cq-E2, qc-E2, qq-E2, and CC-E2 relate to each other? Where do the quantum 
hierarchies obtained by extending cq-E2 to higher levels sit relative to known complexity classes? We 
hope the answers to such questions will help establish classes like cq-E2 as fundamental concepts in the 
setting of quantum computational complexity. 

Organization of this paper: We begin in Section [2] by formally defining the classes and problems 
studied in this paper. In Section [3j we prove that QSSC and QIRR are hard to approximate for cq-E2 
within N £ ; this is further improved in Section|4] Section [5] presents hardness of approximation results 
for QCMA. We close in Section |6]by showing cq-E2-completeness of cq-E2LH and cq-E2-hardness of 
approximation for cq-E2LH-H W. 

2 Definitions 

We now set our notation, define relevant classes and problems, and state lemmas which prove useful in 
our analysis. 

Beginning with notation, the term A >z B means operator A — B is positive semidefinite. The 
spectral norm of A is || A jj^ := max{|| A\v) \\ 2 '■ \\ \v) || 2 = 1}- The projector onto space S is Tig. 
The set of natural numbers is IN. For convenience, we define B := C 2 , and for a set S of matrices over 
C,letH s :=E„ ieS H,. 
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We next give a formal definition of cq-E2- Here, a promise problem is a pair A = (A yeS/ A no ) such 
that A yeS/ A no C {0, 1}* and A yes n A no = 0. 

Definition 11 (cq-E2). Let A = (A yeS/ A no ) Z?e a promise problem. We say that A G cq-E2 if there 
exist polynomially bounded functions t, c, q : IN i— > IN, a«<i a deterministic Turing machine M acting as 
follows. For every n-bit input x, M outputs in time t{n) a description of a quantum circuit V x such that 
V x takes in a c(n)-bit proof \c), a q(n)-qubit proof \q), and outputs a single qubit. We say V x accepts 
\c)\q) if measuring its output qubit in the computational basis yields 1. Then: 

• Completeness: If x G A yes , then 3 \c) such that^l \q), V x accepts \c) \q) with probability > 2/3. 

• Soundness: If x G A no , then V |c), 3 |^) such that V x rejects \c) \q) with probability > 2/3. 

Note that the completeness and soundness parameters can be amplified to values exponentially close 
to 1. Specifically, we use the standard approach of repeating V x polynomially many times in parallel, 
except that we only need one copy of the classical register C for all parallel runs. For any value c placed 
in C, we think of it as being "hardwired" into V x , thus obtaining a quantum verification circuit V X/C , 
which we now apply in parallel to the many copies of the quantum proof |^). The standard weak error 
reduction analysis for QMA now applies (see, e.g. HAN02I0 . Throughout this paper, we refer to this as 
error reduction. 

We next define the terms cQMA circuit, monotone set, QMW, QSSC, and QIRR. 

Definition 12 (cQMA circuit). Let n,m G N + . A cQMA circuit V is a quantum circuit receiving n 
bits in an INPUT register and m qubits in a CHOICE register, and outputting a single qubit \a). We say: 

• V accepts x G {0,1}" in INPUT if for all \y) G B® m in CHOICE, measuring \a) in the compu- 
tational basis yields 1 with probability at least 2/3. 

• V rejects x G {0, 1}' ! in INPUT if there exists a |y) G B® m in CHOICE such that measuring \a) 
in the computational basis yields with probability at least 2/3. 

Definition 13 (Monotone set). A set S C {0,1}" is called monotone if for any x G S, any string 
obtained from x by flipping one or more zeroes in x to one is also in S. 

Definition 14 (QUANTUM MONOTONE MINIMUM WEIGHT WORD (QMW)). Given a cQMA 
circuit V accepting exactly a non-empty monotone set S C {0,1}", and integer thresholds < g < 
g' < n, output: 

• YES if there exists an x G {0, 1}" of Hamming weight at most g accepted by V. 

• NO if all x G {0, 1}" of Hamming weight at most g' are rejected by V. 
Note that clearly QMW G cq-Z 2 . 

Definition 15 (QUANTUM SUCCINCT SET COVER (QSSC)). Let S := {H,} be a set ofb-local 
Hamiltonians Hj acting on N qubits such that £ H eS H; >z otl for a > 0. Then, given j6 G 1R such that 
a. — /3 > 1 and integer thresholds < g < g', output: 

• YES if there exists S' C S of cardinality at most g such that Y^HjeS' Hi — oc ^- 

• NO if for all S' C S of size at most g', J^H.^gi Hj has an eigenvalue at most ft. 
Any S' satisfying the YES case is called a cover. 

Note that requiring a — G O(l) above is without loss of generality, as any instance of QSSC with gap 
1/ p(N) for p a polynomially bounded function can be modified to obtain an equivalent instance with 
constant gap by multiplying each H, by p(N) |Wat09]. 
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Definition 16 (QUANTUM IRREDUNDANT (QIRR)). Given S := {c f Hj}, where each H f acts on N 
qubits and is a tensor product of 5-local orthogonal projection operators and C; > are real. Then, 
given ol, B G 1R such that ol — B > 1, and integer thresholds < g < g', output: 

• YES if there exists S' C S of cardinality at most g such that for all \ip) G B® N : 

- IfTr(H s \ip)(ip\) > ol, thenlT(H s >\\p){ip\) > ol, and 

- IfTr(H s \f)(tp\) < B, thenTr(H s ,\xp){tp\) < B. 

• NO if for all S' C S of cardinality at most g', there exists \ip) G B® N with Tr(Hg \lp) (xp\) > a. 
and Tr (H s > (V| )< A 

Roughly, QSSC asks how many local interaction terms in a local Hamiltonian one can discard while 
maintaining the value of the worst assignment. This is intended to mimic the idea of maintaining a 
tautology for a 3-DNF formula in SSC classically. Analogous to the relationship between SSC and IRR, 
QIRR allows possibly non-local Hamiltonian terms so long as they have a succinct description (this 
generalizes the use of superconstant arity in IRR) and are projectors up to scalar multiplication (this 
generalizes the requirement that each term f, in IRR is an AND of variables). QIRR then asks how 
many interaction terms can be discarded in a sum of such Hamiltonian terms while ensuring that any 
assignment \ tp) achieves approximately the same value on both the original and modified Hamiltonians. 

Next, the key tool enabling the creation of a gap in our reductions is a disperser (see e.g., MSZ941 
ITSUZ07I0 . 

Definition 17 (Disperser). Let G = (L,R,E) be a bipartite graph with \L\ = 2", \R\ = 2 m and left- 
degree 2 d . Then, G is called a (k,e) -disperser if, for any subset L' C L of size \L'\ > 2 k , U has at least 
(1 — e) \R\ neighbors in R. Moreover, if for any pair (v G L,i), one can compute the ith neighbor of v 
in time polynomial in n, then the disperser is called explicit. 

Finally, we recall useful known facts from Hamiltonian complexity theory. We first state two lemmas 
used to bound the eigenvalues of a pair of non-commuting operators. 

Lemma 18 (Kempe, Kitaev, Regev [ KKR06 ] , Projection Lemma). Let Y = Y\ + Y2 act on Hilbert space 
H = S + S 1 - for Hamiltonians Y\ and Y%. Denote the zero eigenspace of Y2 as S, and assume the Y% 
eigenvectors in S have eigenvalue at least ] >2\Y\\ O0 . Then, for A(Y) the smallest eigenvalue ofY 
andY\ s := n^Yn^, 

A ( y ils) " j zTji hi ^ A ( y ) ^ A ( y ils) • 
j 11 1 11 00 

Lemma 19 (Kitaev, Shen, Vyalyi HKSV02H . Geometric Lemma, Lemma 14.4). Let Ai,A 2 >: 0, such 
that the minimum non-zero eigenvalue of both operators is lower bounded by v. Assume that the null 
spaces C\ and C2 of A\ and A2, respectively, have trivial intersection, i.e. C\ D £2 = {o}- Then 

A l + A2^2vs^ ° i{Cl 2 Cl) I , (2) 

where the angle a( X , 3^) between X and y is defined over unit vectors \x) and \y) as cos [Z(X, y)] := 
™ax\x)ex,\y)ey \( x \y)\- 

We next recall Kitaev's circuit-to-Hamiltonian construction BKSV021 . Given a cq-E2 verification 
circuit V = Vi • • • V\ (where without loss of generality, each V, is a one- or two-qubit unitary) acting on 
n proof bits (register A), m proof qubits (register B), and p ancilla qubits (register C), this construction 
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outputs a 5-local Hamiltonian H acting on A ® B ® C ® D, where D is a clock register consisting of L 
qubits. We then have H := Hi n + H ou t + H prop + H sta b, for penalty terms as defined below: 

:= I A ,b® fE|l)(l| Q j ®|0>(0| D 



Id 



H out := I A <8) |0)(0 1 Bi ®I C (8) | L)(L | 

L 

Wp r op : = 2^ where Hi is defined as 

-^•®|;)0 , -i| d -^®|;-i)01 d + ^®(|;){;| + |;-i>0'-i|)d 

L-l 

H stab := I«c8E|01)(01| Di , D , + , 

i=l 

Above, the notation A\ refers to the z'th qubit of register A (similarly for B, C, D). For any prospective 
proof \tp) in Tr(H|i/>) each penalty term has the following effect on the structure of \tp): Hj n 
ensures that at time zero, the ancilla register is set to zero as it should be for V. H out ensures that at 
time step L of V, measuring the output qubit causes acceptance with high probability. H prop forces all 
steps of V appear in superposition in \tp) with equal weights. Finally, note that for Hj n , H out , and H prop 
above, time t in clock register D is implicitly encoded in unary as |l'0 L ~ f ) (for H sta b above, register D 
is already explicitly written in unary); H sta b is thus needed to prevent invalid encodings of time steps 
from appearing in D. 

We use two important properties of this construction. First, the null space of Hi n + H prop + H sta b 
is the space of history states, which for arbitrary \^}a,b are defined as 

1 L 

Whist := - 7 ==E l V i ---V 1 \il>) Ai B® |0) c ®|z)d. (3) 
V L + 1 ;=o 

For cq-E2 circuits V, it is convenient to define for c G {0, l} n and \q) £ B m the shorthand \c, ^)hi S t := 
I V) hist for \tp) = \c)\q). The second important property of H we use is that its spectrum is related to V 
as follows. 

Lemma 20 (Kitaev [K SV02I0 . The construction above maps V to (H, a, b) satisfying: 

• If there exists a proof \tp) accepted by V with probability at least 1 — e, then |i/?)hist achieves 
Tr(H\tp)(xp\ Ust ) <afora:=e/(L + l). 

'\-sfe 



IfV rejects all proofs \ip), then H >z hi for b £ Q f ^ 



3 Hardness of approximation for cq-E2 

We now show hardness of approximation for cq-E2 for the problems QMW, QSSC, and QIRR. We begin 
with a gap-introducing reduction from an arbitary problem in cq-E2 to QMW. We remind the reader that 
the hardness ratios obtained here are further strengthened in Section [4] 

Theorem 21. There exists a polynomial time reduction which, given an instance of an arbitrary cq-E2 
problem, outputs an instance of QMW with thresholds g and g' satisfying g' I g £ &(N £ ) for some 
e > 0, where N is the encoding size of the QMW instance. 
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Proof. The reduction follows Theorem 1 of Umans [Uma99] closely; the points where we deviate 
from [Uma99] are explicitly noted. Let Yl be an instance of an arbitrary promise problem A = 
(A yeS/ A no ) in cq-E2 with encoding size n, and whose verification circuit V has a c(n)-bit existen- 
tial proof register and a ^(n)-qubit for-all proof register. We wish to map IT to a cQMA circuit W for 
QMW such that W accepts strings of small or large Hamming weight depending on whether Yl G A yes 
or IT £ A no , respectively. To do so, we follow [Uma99] and construct an explicit (k, l/2)-disperser 
G = (L,R, E) with left-degree 2 d using Reference llSZ94l . where |L| = 2 C W +1 , \R\ = 2 k+d -°^\ and 
k := 7 log c{n) for 7 G to be set as needed. Note that the value of d depends on the specific 

disperser construction used — for the construction of [SZ94], we have d = 4k + 0(log n). Roughly, 
the idea of Umans is now to have L correspond to assignments for the c{n) -bit classical register of V, 
and R to assignments for the classical register of W (in the setting of [Uma99], note that W is a classical 
circuit). We then encode assignments from L by instead choosing neighbor sets in R. By exploiting 
the properties of dispersers, one can ensure that the sizes of the neighbor sets in R chosen vary widely 
between YES and NO cases for n. 

Specifically, imagine the vertices in L are arranged into a complete binary tree whose 2 C ("' leaves 
denote the 2 c( -") possible assignments to V's classical register. For convenience, we henceforth use L to 
mean this tree. Now, let x G {0,1}^"' denote a leaf of L. Then, a subset of vertices R' C R is said to 
encode x if it contains the union of the neighbor sets of all vertices in the unique path from the root of L 
to x. Figure [T] illustrates this encoding scheme. How do the vertices of R then relate to W? Each vertex 
r G R corresponds to an input bit of W - setting this rth bit to one means we "choose" vertex r. 



Figure 1: Here, the string 11110 • • • in R encodes the string 000 in L. (Note: This graph is not a 
disperser, but nevertheless illustrates the encoding scheme.) 

With the encoding scheme defined, we now construct the cQMA circuit W. Given y and |z) to its 
INPUT and CHOICE registers, respectively, W acts as follows: (a) If y corresponds to a subset Ry C R 
such that \Ry\ > \R \ /2, then W sets its output qubit to one. (b) If |R y | < \R\ /2, then W first decodes 
Ry to obtain the set of leaves L y C L. Roughly, it then outputs one if there exists x G L y causing ITs 
verification circuit V to output one when fed the proofs x and |z). These last two steps require further 
clarification, which we now provide. 

First, given Ry C R, decoding it to obtain the set of leaves Ly C L might a priori require exponential 
time, as recall |L| = 2 C ("' +1 . This, however, is precisely where dispersers play their part: Since we set 
e = 1/2 in constructing our disperser, we know that for any SCR with |S| < |R| /2, there are at 
most 2 k = c(n) 7 vertices in L whose neighbor sets are completely contained in S. Thus, by starting at 
the root of L and performing a breadth-first-search down the tree (where we prune any branches along 
which we encounter a vertex whose neighbor set is not contained in R y , as by definition such vertices 
cannot encode any leaf x), we can efficiently decode Ry to obtain L y while visiting only polynomially 
vertices in L. It remains to specify how W checks whether there exists ani 6 L causing V to accept, 
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and here we must deviate from Umans' construction. 

First, if Ly = 1, our task is straightforward - simply run V as a black box on proofs x G Ly and 
|z), and output the result. Then, W outputs one with probability at least 2/3 on input y for all quantum 
proofs \z) if and only if V also does so on proofs x and |z). If , however, \hy\ > 1, a more involved 
construction of W is necessary. Here, W takes three inputs: a classical description of V, an \R | -bit string 
y to denote subsets in R, and a 2*^ (n) -qubit proof |z). Then, for the zth candidate string x, G L„, W 
feeds Xj and the ith block of q{n) proof qubits of \z) into V. (If |LJ < 2 ,c , we simply re-use values of 
x G Ly in the leftover parallel runs of V.) W then coherently computes the OR of the output qubits of 
all parallel runs of V and outputs this qubit as its answer. 

Let us briefly justify why this works. For simplicity, assume the quantum proof to W can be written 
|z) = |zi) ® • • • ® |z 2 Jt); entangled proofs can be shown not to pose a problem via the same proof 
technique used in standard error reduction IIAN02I . Now, if there exists an x,- G Ly causing V to accept 
for all quantum proofs, then in the zth parallel run of V in W corresponding to x,, V outputs 1 with 
probability at least 2/3 on any |z,), implying W outputs 1 with probability at least 2/3. Conversely, if 
for all Xj G Ly, there exists a quantum proof |z,) rejected by V, then by standard error reduction for V 
and the union bound, the state |z) = \z\) ® • • • <8> \z 2 k) causes W to output 1 with probability at most 
1/3, as required. 

Following Reference [Uma99] again, we now argue that W accepts a non-empty monotone set, and 
we analyze the hardness gap introduced by this reduction. The first of these is simple - namely, W 
accepts a set R' C R if either \R\ > |R/2|, in which case it also accepts any R" D R', or if R' 
encodes some x G L accepted by V, in which case any R" D R' would also encode x and hence be 
accepted. As for the gap, if x G L is an accepting assignment for V when Yl G A yes , then to encode 
x using a subset of R requires at most c(n)2 d vertices in R, where recall 2 d is the left-degree of our 
disperser. On the other hand, if Yl G A no , then the only way for W to accept is to choose R'CR with 
\R'\ > \R\ II ~ c(n)"<2 d . This yields a hardness ratio of Q(c(n) 7 ~ 1 ). Since W's encoding size N is 
polynomial in c(n), there exists some e > such that the ratio produced is of order N £ , as desired. □ 



We next show a gap-preserving reduction from QMW to QSSC. Its proof requires Lemmas 23 



and 24 which are stated and proven subsequently. 



Theorem 22. QSSC is in cq-E2- Further, there exists a polynomial time reduction which, given an 
instance of QMW with thresholds f and f, outputs an instance of QSSC with thresholds g = f + 2 and 
g' = f + 2, respectively. 

Proof. That QSSC is in cq-E2 follows using Kitaev's verifier [KSV02] for putting /c-local Hamiltonian 
in QMA. Specifically, we construct a cq-E2 verification circuit for QSSC which takes a description c of 
some subset of local Hamiltonians S := {H, } in its classical register, and estimates the energy achieved 
by \q) in its quantum register against H$ using Kitaev's approach, outputting zero or one according to 
whether the measured energy is above or below the desired thresholds. 

To reduce QMW to QSSC, suppose we are given a cQMA circuit V accepting exactly a non-empty 
monotone set T C {0, l} n and threshold parameters / and /'. We assume without loss of generality 
that V is represented as a sequence of one and two qubit unitary gates Vj such that V = Vi • • • V\. We 
also assume using standard error reduction that if V accepts (rejects) input x G {0, 1}", then it outputs 
one (zero) with probability at least 1 — e := 1 — 2~ 4 ( n+m ). 

We now state our instance (S, a, fi,g,g') of QSSC as follows. We first apply Kitaev's circuit-to- 
Hamiltonian construction from Section [2] to V to obtain a 3-tuple (H,a,b). Note that H = Yd=\ Hi 
with r terms X H; X I. Then, set cc := 1 - (£ + l)e, and £ := 2(1 + 2 2 (' !+m ))/(L + 1). Define 
/S := 1 - b. Note that for large n + m, this yields a > 1 - 2-("+ m ) and /3 < 1 - c(l - 2-("+'"))/L 3 
for some constant c. Further, define g := / + 2, g' := f +2, and let S consist of the elements (intuition 
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to follow) 



Gi 



(L + l)\0)(0\ Al ®h, c ®\0)(0\ 



D 



G,i+i 

G n +2 



(L + 1)|0)(0| Ah 
(A + l)(H in + H, 

I — (Hjn + H, 



*prop 



^®|0>(0| D 

prop + H sta ]-> ) 

H sta b + H ut)/ 



(4) 



for A > to be chosen as required, and where A, denotes the z'th qubit of register A. Intuitively, 
the terms in S play the following roles: G n+ \ penalizes assignments which are not valid history states. 
G )3 +2 penalizes valid history states accepted by V. Finally, the G, for i G [n] penalize valid history 
states rejected by V (recall that V accepts a monotone set, and so flipping a one to a zero in register A 
may lead V to reject). Thus, we cover the entire space. We now make this rigorous. 



As required by Definition 15 we begin by showing that S itself is a cover, i.e. that G$ b &Ia,b,C,d- 
First, note that 



Gs = I + E G; — H> ut + A(Hin + Hprop + H sta b). 
i=l 



(5) 



It thus suffices to prove that for large enough A, 



A(H in + H prop + H stab ) + (E G U _ t - (£ + l)el. 



(6) 



To show this, we use Lemma 18 the Projection Lemma, with 



Y 



l •- 



EG, 

vt=l 



H, 



out/ 



Y 2 :=A(H in + H 



prop 



H. 



stab; 



(V) 



Intuitively, the Projection Lemma tells us that by increasing our weight A, we can force the smallest 
eigenvalue of Y\ + Y2 to be approximately the smallest eigenvalue of Y\ restricted to the null space of 
Y2. In our setting, this implies it suffices to study the smallest eigenvalue of Y\ restricted to the space of 
all valid history states, i.e. states of the form of Equation Let tS ft j st denote the space of valid history 
states; note tShist * s tne nim space of H\ 
bound A(Yi|5 ), we invoke Lemma 
This yields A(Yi| 5hist ) > -£e. Noting that 



24 



- Hp r0 p + H sta b- Then, in the notation of Lemma 18 to lower 
to instead upper bound the largest eigenvalue of\—Y\ 
Yi Wgg < n(L + 1) + 1, and since by Lemma 23 



18 



^hist " 

the 



that by setting A G 



smallest non-zero eigenvalue of Y 2 scales as Q(A/L 3 ), it follows by Lemma 
n(n 2 L 5 / e), we have Y\ + Y2 >z — (£ + \ )el, as desired. This completes the proof that S is a cover. 

We now show the desired reduction. Assume first that V accepts a string x of Hamming weight k, 
and let T C [n] be such that i G T if and only if = 1. We claim there exists a cover S' C S of size 
\S'\ = k + 2 which consists of G n+i , G n+ 2, and the A; terms G,- such that z G T. To show this, following 
the proof above, the analogue of Equation (|6]) which we must prove is 



A(Hin + H, 



prop 



H. 



stab 




H out h -(C + l)eL 



(8) 



First, applying Lemma 24 again, we lower bound the smallest eigenvalue of Y[ := (YJ !G j G ; ) — H ou t 
restricted to S^ st by — £e. Since || Y{ || < || Yi for Yj from the previous case of T = [n], the value 
of A from before still suffices to apply Lemma 1 8 and conclude that Equation ([8]> holds, as desired. 

Conversely, suppose V rejects any string x of Hamming weight at most k. For any S' C S with 
\S'\ < k + 2, we claim that Gs' has an eigenvalue at most f>. To see this, note first that if G )3+ 2 ^ S', then 
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the state |l",y)hist attains expected value zero against G$i, where note /3 > 0. Similarly, if G n+ \ ^ S', 
then the state \1 h )a,b,c ® |0)d obtains expected value at most zero against G. We conclude that in order 
to refute the claim that G has an eigenvalue at most j6, we must have G„ + i, G n+ 2 G S'. This implies 
that S' contains at most k terms G, for i G [n]. Then, consider the string x which has ones precisely 
at these at most k positions i G [n] corresponding to G ; G S'. It follows that the state |3C,y)hist ues 
in the null space of all terms in S' with the possible exception of G n+ 2- Moreover, since V rejects all 
strings of Hamming weight at most k, there exists by the definition of a cQMA circuit and Lemma 20 a 
\y) G B® m such that 

Tr{G n+2 \x,y){x,y\ hisi ) = l-Tr(H\x,y)(x,y\ bist ) <l-b = p, 

completing the proof. □ 



The following two lemmas are required for the proof of Theorem 22 Their statements and proofs 
assume the notation of Theorem [22] 

Lemma 23. The smallest non-zero eigenvalue ofY 2 = A(Hi n + H pr0 p + H sta b) scales as Q(A/ L 3 ). 

Proof. We bound the smallest non-zero eigenvalue of H[ n + H pr0 p ; it is straightforward to show using 
the approach of Reference [ KS V02 ] that the addition of H sta j, does not affect this lower bound. Our proof 
idea here is to "lift" the null space of Hj n + H pr0 p so that the smallest non-zero eigenvalue of Hj n + 
Wp r0 p becomes the smallest eigenvalue of the lifted operator, and then apply the Geometric Lemma 



(Lemma 19 1 to lower bound the latter. 



To begin, recall that the null space of Hj n + H prop consists of all valid history states 

1 1 



hist = 7= = E y i ' • • V A$)a,B ® \0) c ® \i) D , 

y/L + 1 i=Q 



for any |i/^)a,b- (Since we omit H sta b for now, we assume here that the clock register is represented in 
binary, i.e. there are no invalid clock states.) As done in Reference MKSV02I1 , our analysis is simplified 
by first applying the unitary change of basis W = Y]f=o V\ ' ' ' Vj ® \j) (/|> yielding 

W|V)wirt = \iP)a,b®\0)c®\7)d 
WH in W + = H in = I ArB ® ( £ |l)(l| c . ] ® |0)(0| 



D 



vt=l 



WH prop W + = J A , B ®J C 



where I7) := y ^4=0 lOJ' anc ^ f° r some operator £o whose eigenvalues are given by A; c = 
1 — cos(7rA:/ (L + l))forO<A:<L and whose unique zero-eigenvector is (7). 

As alluded to above, we now lift the null space of W(Hi n + Hp r0 p)W + . Letting denote the 
projector onto the space of valid history states |tp)hi S t» this is accomplished by defining 

M := W(Hin + pn hist )W t 
A 2 := W(H prop +2n hist )W t . 

Note that [^,11^] = [H prop/ n hist ] = 0, || H in ^ < p and II H prop II < 2. It thus remains to 



lower bound the smallest eigenvalue of A\ + Ai, for which we apply Lemma 19 to A\ + A2 via the 
approach of Reference HKSV02L For this, we require values for the parameters v and ot(C\, £2). 

For v, note that since A\ is a sum of commuting orthogonal projectors, its smallest non-zero eigen- 
value is at least 1 (assuming p > 1). Similarly, one infers from the spectrum of Ed stated above that the 
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smallest non-zero eigenvalue of A 2 scales as O ( 1 / L 2 ) . It follows that v G Q ( 1 / L 2 ) . As for a ( C\ , £2 ) , 
note that the null spaces C\ and £2 can be written as 

d = 6® ( B " +m) ®span(|i/;) : <^|0 - - - 0) = 0) c <8>span(|l),. . ., |L)) D (9) 
Bf£ +m) ® |0- • • 0) c ® span(^) : <t/>|7> = 0) D , (10) 
C 2 = H^ B n+m) ®span(|t^) : <^|0 • • - 0) = 0) c ® |7>d- 



Observe that £1 fl £2 = {0}, as required by Lemma 19 Then, letting 11^ denote the projector onto 
C\, we analyze 

cos 2 £2) = max |(*|y)| 2 = max (j/in^ly) = max (y|IIi + II2I1/)/ 

unit \x)££i,\y)€:C2 unit|y)e£2 unit|y)e£2 



where Eli and IT2 project onto the spaces in Equations (|9]> and (10 1, respectively. As (y|n.2|y) = 
0, we simply need to maximize (y|Lli|y), which is equivalent to maximizing | (t^lV) | 2 f° r anv urul: 
vector \tp) in register D and for unnormalized state I7') := ( v /]~pj Ei=l 10)- By ^ e Cauchy-Schwarz 
inequality, this quantity is upper bounded by L/ (L + 1). We thus obtain the bound cos ol{C\, £2) < 
a/L/(L + 1). Combining this with the identity 2 sin 2 | = 1 — cos x and the Maclaurin series expansion 

for \J\ + x (where \x\ < 1) yields 2sin 2 > ^x+xy ■ Substituting into Lemma 19 the desired 

result follows. □ 

Lemma 24. Define El hist := E xe {o / l} B / ye{o,l} m I x ^ 3/)< x ^ 3/lhist a5 ^ e projector onto S h ist> let Z, := 
2(1 + 2 2 ("+'"))/(L + 1), am/ consider T C [n]. TTien, i/T owfpwfa one w/f/z probability at least 1 — e 
for inputs (x, |y)) vv/f/z x G {0, 1}" smc/j f/W x,- = 1/or a// z G T and for all m-qubit |y), one has 



n 



hist 



n his t d Cel. 



Proof Define Zi := Il hist (- YneT Q) n hist and Z 2 := n hist H 0Ut n hist . Letting z G {0,1}" de- 
note the characteristic vector of T, i.e. the zfh bit of z is set to one if and only if i G T, it follows 
that any state |x,y)hist * s an eigenvector of Z\ with eigenvalue (x|z) — |T|. Hence, for example, 
Tr (Zi|l",y)(l",y| hi t ) = 0. Further, since V accepts a non-empty monotone set, it must accept in- 
put (1", \y)) with probability at least 1 — e, implying Tr(Z 2 |l w ,y) (l W /y|hist) — iTi- This yields an 
upper bound of 

Tr((Z 1 + Z 2 )|l" / y)(l" / y| hist )<^ T 

in this simple case. We now show that deviating from |l",y)hist above cannot increase our expected 
value against Z\ + Z2 by "too much". 

To do so, let \(p) = 0i\ \(p\) + &2 \<pi) be an arbitrary valid history state where |«i | 2 + |«2 | 2 = 1, \<pi) 
is a (normalized) superposition of valid history states where each history state in the superposition has a 
string x in register A at time zero satisfying x, = 1 if i G T, and where Ifc) is a valid history state in 
the space orthogonal to space of all possible states | <p\ ) . We thus first have that 

Tx(Z x \<p){<p\) < O + aiTrCZilfcXfcl) < «i[(|T| - 1) - |T|] < -\oc 2 \ 2 . 

Moving on to Z2, observe that straightforward expansion yields 

Tr(Z 2 |4>)<4>|) = | ai | 2 Tr(Z2|^i)(^ 1 |) + | a2 | 2 Tr(Z2| ( /)2)(</'2|) 



ai «|Tr (Z 2 1 fa ) (fa 1 ) + ct\ a 2 Tr (Z 2 1 <£ 2 ) (£ 
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To upper bound this quantity, we use the fact that (a\b) + (b\a) < (a\a) + (b\b) for complex vectors 
\a) and \b). Namely, setting \a) := «ia/Z 2 |</>i) and \b) := otiy/Z^fo) yields 

Tr(Z 2 |^)(^|) < 2| ai | 2 Tr(Z 2 |^ 1 )(^ 1 |)+2| a2 | 2 Tr(Z 2 |^ 2 )(^ 2 |) 

< 2| ai | 2 Tr(Z 2 |^ 1 )(^ 1 |)+2| a2 | 2 -^- T/ (11) 

where the second inequality follows since ||Z 2 || 00 < 1/(L + 1). Finally, in order to upper bound the 
term Tr(Z 2 |<^i) ((pi |) in Equation (fTTj), observe that since by assumption Tr(Z 2 |x,i/) (x,}/]^) < j^j 
for all x with x, = 1 for i G T, anasince H out is a projector, it follows that the norm of H out |z,i/)hist 
is at most el (L + 1). Using the Cauchy-Schwarz inequality, this implies that each cross term in the 
expansion of Tr (Z 2 1 (p\ ) {(pi | ) can contribute a value of magnitude at most e/ (L + 1 ) . Since there are at 
most 2 2 (" +m ) such cross terms, and since the non-cross terms are weighted by a convex combination, we 
hence have the upper bound of Tr(Z 2 |0i)(tf>i|) < (1 + 2 1{n+m) )ef (L + 1). Combining these bounds, 
we have 

Tr((Z 1 + Z 2 )|^)^|) < 



< 



l2 2|a 1 | 2 (l + 2 2 ("+ m ))e 2|« 2 
« 2 + \ . . ~ + 



L+l L+l 

2 |ai| 2 (1 +2 2 (" +m ')e+ |a 2 | 2 (1 — L) 



L + l 



2(1 



>2(n+m) 



L + l 



where the second inequality holds when L > 1. □ 

Finally, we show that QIRR is cq-Z 2 -hard to approximate. 

Theorem 25. There exists a polynomial time reduction which, given an instance of an arbitrary cq-Z 2 
problem Yl, outputs an instance of QIRR with threshold parameters h and h' satisfying h! /h E 0(N e ) 
for some e > 0, where N is the encoding size of the QIRR instance. 



Proof. We begin by applying Theorems 21 and 22 to reduce the instance of IT to an instance (S = 
{G,}"^ 2 , ol, f>, g,g') of QSSC, and henceforth assume the terminology and definitions introduced in 



Theorem 22 Recall that any cover in this QSSC instance must include the terms G„ + i and G n+2 . 
For ease of exposition, we first reduce this instance to QIRR with parameters h = g + 2r — 3 and 
h' = g' + 2r — 3, where recall r is the number of terms in H = Yli=\ Hi- This, however, does not 



suffice to obtain a hardness of approximation gap, as tracing through Theorems 21 and p2^ yields r £ 



co(g),co(g'), implying h' /h — > 1 as the instance Yl in Theorem 21 grows in size. We then slightly 
modify our reduction to improve the threshold parameters to h = gr — 1 and h! = g'r — 1, which yield 
the desired hardness of approximation gap. 

We now state our instance (T ',7 ,S ,h,h') of QIRR, and follow with an intuitive explanation. For 
simplicity of exposition, we assume r is a power of two, but our construction can be easily modified to 
handle the complementary case. We also label H r = H out . We now introduce three registers: a "tag" 
qubit register (denoted A), the space the original cover S acts on (denoted B), and logr "chaperone" 
qubits (denoted C). The Hamiltonian terms we define for QIRR, T := {F,}"^ 2 ^ \ act on A (8) B ® C = 
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B <8> £®("+>"+P+<?) ® i3® lo s r , and are denned as: 



Fx := \0){0\ A ®(Gi) B ®Ic 

F„ := |0)(0| A ®(G„) B ®J C 
F n+1 := (A + l)[|0)(0| A ^(H 1 ) B ^7 c + |l)(lU^- f B^|0)(0|c] 

F n+r _i := (A + l)[|0)(0| A (2)(H r _ 1 ) B (2)Jc + |l)(l| A ®I B ®|r-2)(r-2| c ] 
/» r := |0)(0| A ® (J-Hi) B ®J c + |l)(lL® J B® k-l)(r-l| c 

F„ +2 r-i := |0)(0| A O (/ - M r ) B O / c + |1>(1U O |r - l)(r - l| c . 

We set 7 := ot + r - 1, £ := £ + r - 1, ft := g + 2r - 3, and /i' := g' + 2r - 3. Note that each Fy is a 
projection up to scalar multiplication, as required. We now provide the intuition behind the construction. 
QIRR is stated in terms of projectors Fj (up to scalar multiplication), whereas QSSC is stated in terms of 
Hermitian operators G,. Hence, in order to move from the latter to the former, a natural idea is to treat 
each local Hamiltonian term in the sums comprising G n+ \ and G n+ 2 as distinct terms F n+ \, . . . , F„+ r _i 
and F n+r , . . . , F n+ 2 r -\, respectively. The problem with this approach is that in order to rigorously argue 
that the gap between thresholds g and g' for QSSC is preserved when defining thresholds h and h' 
for QIRR, we would like, for example, that all terms Fj making up G n+ \ are chosen together in any 
candidate cover V C T. To address this issue, we introduce the chaperone qubits, which ensure that 
any candidate V plays by these rules. In particular, we can make sure that all terms F n +i, . . . , F n+ 2r-i 
are chosen in any V , allowing us to rigorously apply our knowledge of the spectra of G n+ \ and G n+ 2 to 
the analysis of Ft versus Fji. 

We now show that if there exists a cover S'CS for QSSC of size v, then there exists aT'CT such 
that \T'\ = v + 2r — 3 satisfying the conditions for a YES instance of QIRR. Namely, let 

T ' = { F i}iG{n} and G,GS' U { F n+l, ■ ■ -^n+lr-l}- (12) 

Note that it suffices to show that F T i y jl (since if Fj> >z yl, then Fj y yl as well). To show this, 
observe first that we can write Fj> = K\ + K2, for K\ and K2 defined as: 

K t := |0)(0| A ®( G ! + (A + l)£H l + £a-H l ) ] I c 

\ie[n] andQeS' i=l i=l J B 

= |0)(0| A ®(G s , + (r-l)J) B ®J c (13) 
K 2 := |l>(lU®I B ®^(A + l)^2|i><i|j+r|r-l>(r-l|j 

= |1)(1| A ®J B ® (rI + (& + l-r) T pJi){i^J , (14) 

where we can assume without loss of generality that A > r — 1. Let \<p) = ao\0) a \<po) bc I 1)a|<^i) bc 
be an arbitrary state acting on this space with |flo| 2 + | fl i| 2 = 1 an d for some unit vectors \(po )bc and 
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\(pi) B c- Then 

Tr(FHM0|) = TrCKxI^X^I) +Tr(X 2 |^) <^|) 

= |fl | 2 Tr(Ki|0)(0| ® |tf>o)(tf>o|) + |fli| 2 Tr(K 2 |l)(l| ® 

> |ao| 2 (« + r — 1) + \ a i\ 2r 

> 1, 

where the first inequality follows since Tr(X^g7^ ® Yg) = Tr(Tr^(X^B)YB) and since G$' is a cover 
by assumption, and the second inequality since < a < 1. We conclude that Hji y 7 J, as desired. 

We now prove the other direction, namely that if there does not exist a cover S' C S for QSSC of 
size V, then all subsets T C T of size \T'\ = v + 2r — 3 satisfy the conditions for a NO instance of 
QIRR. To see this, note first that any candidate V must include the terms F, for n + 1 < z < n + r — 1. 
This is because if, for example, F n +i ^ T', then vector \cp) := |1)a|V)b|0)c obtains expected value 
A + 1 > 7 against Ft, but \<p) is orthogonal to Fjk A similar argument holds for the terms Fj with 
indices n + r < i < n + 2r — 1, since state |</>) := |l) / i|i/ ; )B| r — l)c obtains expected value r > 7 
against Fj, but obtains value at most r — 1 < 8 against Fji if there exists an i S [n + r, n + 2r — 1] such 
that i $l T . Thus, for any candidate V of size V + 2r — 3, this leaves i? — 2 terms to be chosen from 
{Ft, . . . ,F n }. If we now restrict ourselves to states of the form \0)a\iP)bc> we fhid that we are reduced 
to the same argument in the NO direction of Theorem [22]- namely, as S is a cover and any S' C S of 
size is not a cover, there must exist a state |<p) := \0)a\^P)bc su °h that 

Tr(|^> <4>|F r ) =Tr[Trc{\tp){tp\){Gs + (r-l)I)} >«+(r-l) > 7, (15) 

whereas 

Tr(|0)<0|F r ) = Tr [& C (^>^|)(G S / + (r - 1)7)] < ^ + (r - 1) = 8. (16) 

This concludes the reduction from QSSC to QIRR with parameters h = g + 2r — 3 and h' = g' + 2r — 3. 

To obtain improved parameters h = gr — 1 and ft' = g'r — 1, we modify the construction above 
as follows (intuition to follow): The terms F ; - for n + 1 < n + 2r — 1 from the old construction remain 
unchanged. For z' S [n], we replace each F, := |0) (0| A ® (G,)b ® Jc with the r distinct terms: 

F u :=|0>(0|, A ®(G i )B®|0)(0| C/ 
Fi,2 ■= |0)(0| A ®(G l -) B ®|l)(l| C/ 

F> := |0)(0| A ®(G i ) B ®|r-l)(r-l| c . 

Thus, the total number of terms in our QIRR instance increases from n + 2r — 1 to r(n + 2) — 1. 
Intuitively, we have used the chaperone qubits to split each F, into r terms Fu, such that if in the old 
construction we chose F 6 T', then in the new construction we must place all r terms F; v in T in order 
for the new Fj> to maintain its desired spectrum. Thus, whereas the old construction chose g — 2 terms 
Fj to place in T', the new construction chooses r(g — 2) terms Fu to place in T, yielding the desired 
thresholds h = gr — 1 and h' = g'r — 1. 

The completeness and soundness proofs now follow similarly to the previous case. Namely, given a 
cover S'CS for QSSC of size v, the set T C T with |T'| = vr — 1 we choose is 

T ' = l F whe[n] and G/eS',/e[r] U ' ' ' ' F n+2r-l}- (17) 

Since Fj> in this new reduction is precisely Fji in the old reduction, the remainder of this direction 
proceeds identically. Conversely, if there does not exist a cover S' C S for QSSC of size v, we similarly 
first argue that F, for n + 1 < z < n + 2r — 1 must be chosen in any candidate T C T of size 
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\T'\ = vr — 1, leaving r(v — 2) terms to be chosen from {Fi,i, . . . ,Fn,r}- This implies that for any 
such T, there must exist a j G [r] such that the number of terms Fu in T is at most v — 2. Since 
no cover of size v exists for our QSSC instance, we conclude there exists an appropriate choice of 



\cp) ■= 1 0) A | f) B \j) c such that Equations (15 1 and (16 1 still hold. □ 



4 Improvements to hardness gaps 



We now improve the hardness gaps of Theorems 2 1 221 and 25 to obtain the results claimed in Theo 



rems[5]and[7] The key idea is to use the fact that the gap for QMW from Theorem 21 can be amplified 
by composing the cQMA circuit W with itself. The results here adapt Section 5 of HUma991 in a simple 
manner to the quantum setting. 

Specifically, assume for the moment that the output qubit of W is actually a classical bit, i.e. that the 
output qubit is given after being measured in the computational basis. Then, one can recursively define 
W 1 := W and W* as W f_1 with n independent copies of W at each of its n INPUT bits. (Note that 
entanglement between quantum proofs for different copies of W does not affect the soundness of W f , as 
each W outputs a classical bit, and no quantum proofs are reused.) Now, such a recursive composition 
of W can easily be made well-defined even if Ws output qubit is a superposition of |0) and |1) using 
the principle of deferred measurement [NC00] - namely, without loss of generality, we can assume W 
first copies its n classical INPUT bits to an ancilla, and henceforth acts only on its CHOICE and ancilla 
registers. Thus, the output qubit of each copy of W in W t is effectively used only as a classical control 
in the remainder of the circuit, and so the measurement of all output qubits can be deferred to the end of 
W l . Finally, since we can assume using standard error reduction that the completeness and soundness 
error of W scale as 2~ n , it follows by the union bound that with probability exponentially close to 1, all 
the W circuits comprising W l output the correct answer. In other words, with high probability, one can 
think of W* as a composition of zero-error circuits W (where zero-error means zero completeness and 
soundness error). With this viewpoint, the proof of Lemma 3 of Reference [Uma99] directly yields the 
following result in the quantum setting. 

Lemma 26. If W is a cQMA circuit accepting exactly a monotone set, it follows that: 

1. | W t \ < n f \W\, where \W\ denotes the size ofW, 

2. W accepts an input of Hamming weight k if and only ifW accepts an input of weight k*, 

3. W f accepts exactly a monotone set. 



To improve the hardness gap of Theorem 21 we now simply replace the cQMA circuit W con- 
structed in the proof of Theorem 21 with W f for an appropriate choice of t. The details and resulting 
analysis follow identically to the proof of Theorem 4 of Reference [Uma99], which combined with the 
improved disperser construction of Reference [TSUZ07] (see Theorem 7.2 therein) yields: 

Theorem 27. QMW is cq-Y,2-hard to approximate with gap N 1 ~ e for any € > 0, for N the encoding 
size of the QMW instance. 

Using this as the starting point in our reduction chain to QSSC and QIRR, a closer analysis of the 
proofs of Theorems [5] and [7] now yields: 

Corollary 28. QSSC and QIRR are co^2-hard to approximate with gaps N 1_e and N?~ £ for any 
£ > 0, respectively, and where N is the encoding size of the respective QSSC and QIRR instances. 
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5 Hardness of approximation for QCMA 



We now briefly remark that the approach of Theorems 21 and 27 can be adapted to show hardness of 
approximation for QCMA. Our result is a straightforward extension of Umans' classical result IUma99] 
showing NP-hardness of approximation for the problem MONOTONE MINIMUM SATISFYING AS- 
SIGNMENT 

Specifically, define the problem QUANTUM MONOTONE MINIMUM SATISFYING ASSIGN- 
MENT (QMSA) analogously to QMW, except with the definition of a cQMA circuit V modified to drop 
the second (quantum) proof, i.e. V now only takes one input register comprised of n classical bits. (For 
example, Definition 12 is modified to say that V accepts x G {0,1}" in INPUT if measuring \a) in 



the computational basis yields 1 with probability at least 2/3.) Then, it is straightforward to re-run 
the proofs of Theorems 21 and [27] without the existence of a second quantum proof register, leading to 
Theorem [8] 



6 A canonical cq-1,2 -complete problem 

In this section, we first show that a quantum generalization of the canonical Ej-complete problem 
E2SAT, denoted cq-E2LH, is cq-E2-complete. We then observe that a similar proof yields cq-E2- 
hardness of approximation for an appropriately defined variant of cq-E2LH. 

Definition 29 (cq-E2LH). Given a 3-local Hamiltonian H acting on N = n + m qubits, and a, b G 1R 
such that a < bfor b — a > 1, output: 

• YESifBxe {0,1}" such that V |y> G B® m , Tr(H|x)(x| <8> |y)(y|) > b. 

• NOifVxe {0,1}", 3 |y) G B® m such that Tr(H\x){x\ ® |y)(y|) < a. 
Theorem 30. cq-E2LH is cq-Y,2-complete. 

Proof. That cq-E2LH G cq-E2 follows from Kitaev's verifier for placing A:-local Hamiltonian in QMA 
[KSV02]. As for cq-E2-hardness, for simplicity we show the result for the case of cq-E2LH defined 
with 5-local Hamiltonians. The proof for the 3-local case follows identically by instead substituting 
the 3-local circuit-to-Hamiltonian construction of Reference [ KR03 ] below (this is possible because our 
proof does not exploit the structure of the clock register or H sta b). 

To see that any instance IT of a problem in cq-E2 reduces to an instance of cq-E2LH, let V" denote 
the cq-E2 verification circuit for n. Recall that V" acts on a classical proof register A, a quantum 
proof register B, and an ancilla register C. We begin by modifying V" to obtain a new equivalent circuit 
V' which first copies the (classical) contents of A to its ancilla register C, and henceforth acts on this 
copied proof in C throughout the verification. This ensures the contents of A remain unchanged during 
the verification. Next, we modify V to obtain V by concatenating to its end a Pauli X on the output 
qubit; this swaps the cases in which V' accepts and rejects, respectively. This is necessary because if 
\c) (8) \cf) is accepted by V, then \c,q) hist obtains low energy against Kitaev's Hamiltonian, whereas 
in our YES instance here we require high energy. Finally, we apply Kitaev's circuit-to-Hamiltonian 
construction from Section|2]on V to obtain a 5-local Hamiltonian H. 

Suppose now that we have a YES instance of IT, i.e. there exists bit string |c) such that for all 
quantum states \q), the circuit V" accepts proof |c) <S> \q) with probability at least 1 — e (and hence V 
rejects |c) <8> with probability at least 1 — e). We show that for all |i^)b,c,d> the state |c) a ® \^P)b,c,d 
attains expectation value at least b against H, for b from Lemma |20j In other words, letting n c := 
(|c) (c\ A (g> h,c,D ) , we claim 

(c| ® (ip\H\c) ® \ip) = (c\ ® (xp\Tl c HU c \c) ® \xp) > b. 
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To see this, observe first that 

n c H out n c = 
n c H stab n c = 



V 



c)(c\ A ®I B ® E|1)(1| Q ®|0)<0| D =: \c){c\ A ®H[ n , 



L 1 ^ouf 



|c)(c| A ®|0)(0| Bi ® I c ® \L)(L\ D =: \c)(c\ 

L-l 

\c)(c\ A ®I BiC ®Y^ |01)(01| D . D . +1 =: \c)(c\ A ®H' tab . 



As for n c Hp r0 pn c , recall that the verification circuit V consists of two phases: The copy phase, con- 
sisting of n CNOT gates copying the contents of A to C, and the verification phase, consisting of the 
remaining L — n gates of V . In other words, we can write 



Hprop = I] Hj ■+ 2^ Hj, 

j=l j=n+l 

where YLJ=\ Hj corresponds to the copy phase and YLj= n +i Hj to tne verification phase. Since during the 
verification phase, V does not act on A, we have for all j > n that 



n c H ; n c 



\c)(c\ A ® 



\{Vj)B,c ® - i| D - \{vJ)b,c ® I; - 1)0V 



^c®(|;)(;1 + |;-i)(;-i|)i 



\c)(c\ A ® Hj. 



As for the copy phase, let |i) (i\ <g> I act on B ® B for i G {0, 1}. Then, observe that 

(|t)(i|®I)CNOT(|i)(i|®I) = \i){i\®X l , 

where X is the Pauli X operator and X' = X if i = 1 and X' = I otherwise. This implies that for any 
step j < n, i.e. where V applies a CNOT gate with qubit Aj as control and Cj as target, and letting Cj 
denote the ;th bit of c, we have 



n c H ; n c 



\c)(c\ 



=■■ \c)(c\ 



2 X q®l;>0' 



lx c > 



l;-i)(;'| D + 



2 

h;(c), 



J®(|;')<j| + |;-i><;-i|)D 



where the notation H-(c) means Hj is a function of c. Letting H prop (c) := £f =1 Hj + X^ =n+1 Hj(c) 
and H(c) := H^ + H^ ut + H^ tab + H prop (c), we thus have that (c\ ® (V|H|c) ® = (^|H(c)|^>. 
It thus suffices to show that H(c) >: W. 

To see this, we return to the circuit V, and think of V not as accepting classical input c, but rather 
as corresponding to a set of circuits {V c }, where each V c is just V with c hard-wired into register A. In 
particular, at time step < j < n, V c applies X c i to qubit Cj. Taking this interpretation, we observe 
that for any string c, plugging V c into Kitaev's circuit-to-Hamiltonian yields precisely the Hamiltonian 
H(c). Thus, since by assumption for our particular choice of c, V" accepts \c) ® \q) for all quantum 
proofs |^), it follows that V c rejects all \q) with probability at least 1 — e. Hence, Lemma 20 implies 
H(c) >z bl, as desired. 
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The converse direction proceeds similarly. Namely, suppose we have a NO instance of IT, i.e. for 
all bit strings |c), there exists a quantum proof \q) such that V" rejects |c) <8> |^) with probability at 
least 1 — e. Then, we wish to show that for all c, there exists a \tp c ) such that (t^ c |H(c) |j/> c ) < a, for a 



from Lemma 20 To show this, fix an arbitrary c. Since there exists a |^) such that V c accepts |^) with 
probability at least 1 — e, it follows by Lemma 20 that the history state \xp c ) := Yli=o Vi ' ' " ^i|<7)b <8> 
|0 • • • 0)c ® |z')d indeed satisfies 

(i/> c |H(c)|t/> c ) = (xp c \H[ n + H^ ut + H^ tab + H' piop (c)\tp c ) < + a + + = a. 

□ 



Note that the proof of Theorem 30 has a special property — the string c fed into the classical proof 
register of V" is mapped directly in our reduction to the candidate ground states \c) \q) for 3-local Hamil- 
tonian H. This means, for example, that if there exists a c with the desired properties for a YES instance 
of our starting cq-E2 problem, then setting x = c in Definition [3T] yields that the cq-E2LH instance we 



have mapped to is also a YES instance. It follows that applying the reduction in the proof of Theorem 30 



to our hard-to-approximate instance of QMMW from Theorem [27] directly yields Theorem 10 i.e. that 



the following variant of cq-E2LH, which we call cq-E2LH-HW, is cq-E2-hard to approximate. Intu- 
itively, cq-E2LH-HW is defined analogously to cq-E2LH, except that here the goal is to minimize the 
Hamming weight of x. 

Definition 31 (cq-E2LH-HW). Given a 3-local Hamiltonian H acting on N = n + m qubits, a, b G 1R 
such that a < b for b — a > 1, and integer thresholds < g < g', output: 

• YES if there exists X E {0,1}" of Hamming weight at most g such that for all \y) G B® m , 
Tr(H\x)(x\®\y)(y\)>b. 

• NO if for all x G {0,1}" of Hamming weight at most g', there exists \y) G B® m such that 
Jx{H\x){x\®\y){y\)<a. 
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